The FDA's Quality Management System Regulation took effect on February 2, 2026, replacing the Quality System Regulation and incorporating ISO 13485:2016 into 21 CFR Part 820. On the same day, the agency retired the Quality System Inspection Technique it had used for decades and moved to a new process under Compliance Program 7382.850.
A few months in, the first data from QMSR inspections have arrived, and FDA officials have described it at several industry conferences. The headline is straightforward: the categories being cited are familiar, but the way an inspection reaches them has changed.
This guide covers what QMSR inspections are citing so far, how the new inspection model works, and the specific actions device manufacturers should take now to prepare.
What QMSR Inspections Are Citing So Far
At the FDA Law Institute's annual conference in May, Keisha Thomas, associate director in CDRH's Office of Product Evaluation and Quality, said the agency had completed just over 100 QMSR inspections.
For Form 483 observations issued between February and mid-April, she ranked the top areas as risk management, outsourcing and purchasing, complaint handling and feedback, UDI, and corrective action. Her summary of the central change was blunt:
"Risk, risk, risk, risk."
The order is not settled. At MedCon in late April, officials put risk management first, followed by outsourcing and purchasing. Speaking about four months in at the RAPS Quality Conference, Thomas listed risk management, corrective action, risk-based approach, complaint handling, and purchasing, and noted that the agency is largely seeing the same citations it saw before QMSR, only reordered.
That caveat is worth holding onto. The problems are not new. What changed is how QMSR inspections find them.
Under QSIT, investigators worked through four subsystems, each more or less in isolation. Under CP 7382.850, the inspection is organized around six QMS areas and built to follow product risk across the lifecycle.
The investigator identifies the risks a device could pose, then uses the company's own risk documentation to navigate the rest of the system. Risk management is no longer one file among many. It is the path the inspection takes.
Two structural changes deserve attention before you prepare:
We're recommending teams reorganize their QMS documentation and inspection-prep mental model around the six QMS areas in CP 7382.850, not the legacy QSIT subparts. Observations now reference ISO 13485 clause language.
Also, review your internal audit program against the assumption that the FDA can read the results. Make reports factual and specific, and make sure your audits are designed to find real issues.
| 📄 Read the FDA's own QMSR town hall transcript so your team understands how investigators are being told to inspect. |
What follows is where the early findings are clustering, what investigators are looking for in each area, and what to do about it.
QMSR inspections treat risk management as a living system rather than a design deliverable. Thomas said firms are being cited for a lack of process and evidence showing that risk is rooted in their decisions, and stressed that risk management must keep evolving after launch.
Many companies still manage the risk file as something built during design and revisited only when a formal change forces it. On paper the file looks complete. What it often cannot show is how postmarket information flows back into it.
|
A few action items:
|
QMSR inspections sharpen the supplier question from "was this supplier approved" to "is the level of control proportionate to the risk this supplier carries." The weakness investigators find is rarely an empty supplier file.
It's a generic one, where a low-risk packaging vendor and a critical contract sterilizer are governed by the same template and the same thin quality agreement.
|
A few action items:
|
Complaint handling is a recurring area of concern in QMSR inspections and our own audit work for device firms, and it usually fails at handoffs rather than in the procedure itself.
Intake comes in too thin to support an investigation. Classification rules are loose. Closed complaints never flow back into the rest of the system.
|
A few action items:
|
UDI reads like a labeling or registration task, but QMSR inspections are exposing it as a data-control problem. Investigators are instructed in the new inspection manual to confirm that the data in AccessGUDID matches the labeling and the device, and they review GUDID before they arrive on site.
Failures cluster around GUDID entries that do not match the label, direct-mark and labeled identifiers drifting apart across packaging revisions, and identifiers not updated when a model or kit configuration changes.
|
A few action items:
|
CAPA has been a top device finding for years, and QMSR does not change the basic expectation: find the cause, act, verify effectiveness, prevent recurrence. What changes is the standard of adequacy. A CAPA that stops at the manufacturing symptom is harder to defend when the evidence points to a design, supplier, validation, or risk-control cause.
Do not read corrective action's middle-of-the-pack ranking as good news! Because CP 7382.850 splits the old CAPA subsystem into separate areas, the apparent decline in corrective-action citations is partly an accounting effect that can hide exposure across data analysis and preventive action.
The work did not get easier here. It just sort of got distributed.
|
A few action items:
|
A procedure-by-procedure gap assessment will not reveal how QMSR inspections actually probe a quality system. Tracing a single product through the system will.
Pick one marketed device, ideally one with real complaint history, supplier complexity, or recent changes, and follow the thread:
|
Wherever that trace breaks is where an investigator working from the risk file is most likely to start. Run the exercise on two or three products that represent your range, and you will have a realistic preview of your next QMSR inspection.
The early data confirms what the rule signaled: QMSR inspections evaluate whether risk connects your quality system, not whether each system can stand on its own. The organizations that hold up best are the ones that can show risk being identified, controlled, monitored, and updated across the product lifecycle.
The FDA Group supports medical device manufacturers through QMSR inspection readiness, mock FDA inspections, gap assessments, and remediation, drawing on former FDA investigators and senior quality consultants who know how the new inspection model works in practice.
If you want an outside read on how your quality system would hold up under a QMSR inspection, learn more about our services and contact us to talk through a readiness assessment.
Submit the form below to express your interest and get the conversation started.